Overview

overview

10

Static

static

1

a57b9c9eff...95.exe

windows7-x64

10

a57b9c9eff...95.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a57b9c9eff3c29995c88667951c53be37b15c915980b4fd79ec1ef596ba26a95

  • Size

    202KB

  • Sample

    221030-jxjlxaadf3

  • MD5

    a3097463ac8da2a72643453950507f67

  • SHA1

    7dec418a9336d291b0ab0788c5796c38a8f044eb

  • SHA256

    a57b9c9eff3c29995c88667951c53be37b15c915980b4fd79ec1ef596ba26a95

  • SHA512

    d4f6a308854694c7b4bf86410f2d5edca6ce9c8504ab6865b39edbc56f0e2e0e022feb26401891312183856a4e501c55cad3c579ab34be67484e76b6f56ca35b

  • SSDEEP

    3072:pYU94fDhmJNPowSmw7o5ycvrrsMWz+Hcpf9prtOsKVg00eM9DJm8GlpIRC0lhDNB:pcCSShsyctO5ZMJXlp

Score
10/10
bootkitevasionpersistenceupx

Malware Config

Targets

    • Target

      a57b9c9eff3c29995c88667951c53be37b15c915980b4fd79ec1ef596ba26a95

    • Size

      202KB

    • MD5

      a3097463ac8da2a72643453950507f67

    • SHA1

      7dec418a9336d291b0ab0788c5796c38a8f044eb

    • SHA256

      a57b9c9eff3c29995c88667951c53be37b15c915980b4fd79ec1ef596ba26a95

    • SHA512

      d4f6a308854694c7b4bf86410f2d5edca6ce9c8504ab6865b39edbc56f0e2e0e022feb26401891312183856a4e501c55cad3c579ab34be67484e76b6f56ca35b

    • SSDEEP

      3072:pYU94fDhmJNPowSmw7o5ycvrrsMWz+Hcpf9prtOsKVg00eM9DJm8GlpIRC0lhDNB:pcCSShsyctO5ZMJXlp

    Score
    10/10
    bootkitevasionpersistenceupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks